US11397792B2 - Anomaly detecting device, anomaly detecting method, and recording medium - Google Patents
Anomaly detecting device, anomaly detecting method, and recording medium Download PDFInfo
- Publication number
- US11397792B2 US11397792B2 US16/329,794 US201716329794A US11397792B2 US 11397792 B2 US11397792 B2 US 11397792B2 US 201716329794 A US201716329794 A US 201716329794A US 11397792 B2 US11397792 B2 US 11397792B2
- Authority
- US
- United States
- Prior art keywords
- series
- feature amount
- series data
- probability distribution
- anomaly
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active, expires
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N7/00—Computing arrangements based on specific mathematical models
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N7/00—Computing arrangements based on specific mathematical models
- G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/08—Feature extraction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/12—Classification; Matching
- G06F2218/16—Classification; Matching by matching signal segments
Definitions
- the present invention relates to an anomaly detecting device, an anomaly detecting method, and a recording medium which detect an anomaly from series data.
- patent literature (PTL) 1 describes the following method.
- the method is a method which represents, by a probability distribution, a probability that sequentially-input series data are generated, thereby models a state of a generation mechanism of series data at generation, and then detects a statistical outlier emerging in series data and a change point in a state of a generation mechanism.
- PTL 2 describes a method of detecting an anomaly of an observation target by threshold-processing a dissimilarity indicating a degree of difference between a statistical amount of a probability density function of each variable of sequentially-input series data and a statistical amount of a probability density function of a predetermined reference.
- a change in a state of a generation mechanism is not always an anomaly targeted for detection.
- a change in a state of a generation mechanism is not always an anomaly targeted for detection.
- the method described in PTL 1 has an issue that an anomaly truly needed to detect cannot be accurately detected, because a change in an operating state in a normal state is also sensed as an outlier of series data or a change point in a state.
- the method which simply threshold-processes a dissimilarity as described in PTL 2 also has an issue similar to that described above.
- a change in an operating state in a normal state is also sensed as an outlier of series data or a change point in a state, it is not possible to accurately detect an anomaly truly needed to detect.
- an object of the present technique is to enable an anomaly to be accurately detected even from series data resulting from a generation mechanism involving a change in a state.
- An anomaly detecting device includes:
- At least one processor coupled to the memory,
- the processor performing operations includes:
- a reference probability distribution being a probability distribution designated as a reference for the series feature amount in the first series data
- An anomaly detecting method includes:
- a non-transitory computer-readable recording medium computer-readably records an anomaly detecting program.
- the anomaly detecting program causes a computer to perform a method.
- the method includes:
- FIG. 1 is a block diagram illustrating a configuration example of an anomaly detecting device according to a first example embodiment.
- FIG. 2 is a flowchart illustrating one example of an operation of the anomaly detecting device according to the first example embodiment.
- FIG. 3 is a block diagram illustrating a configuration example of an anomaly detecting device according to a second example embodiment.
- FIG. 4 is a block diagram illustrating an example of a reference-probability-distribution generation unit.
- FIG. 5 is a flowchart illustrating one example of a processing flow of reference-probability-distribution generation processing.
- FIG. 6 is a block diagram illustrating a configuration example of an anomaly detecting device according to a third example embodiment.
- FIG. 7 is a block diagram illustrating an example of a normal-model generation unit.
- FIG. 8 is a flowchart illustrating one example of an operation of the anomaly detecting device according to the third example embodiment.
- FIG. 9 is a block diagram illustrating a configuration example of an anomaly detecting device according to a fourth example embodiment.
- FIG. 10 is a flowchart illustrating one example of an operation of the anomaly detecting device according to the fourth example embodiment.
- FIG. 11 is a block diagram illustrating a configuration example of an anomaly detecting device according to a fifth example embodiment.
- FIG. 12 is a block diagram illustrating an example of a series data analyzing unit.
- FIG. 13 is a flowchart illustrating one example of an operation of the anomaly detecting device according to the fifth example embodiment.
- FIG. 14 is a block diagram illustrating a configuration example of an anomaly detecting device according to a sixth example embodiment.
- FIG. 15 is a flowchart illustrating one example of an operation of the anomaly detecting device according to the sixth example embodiment.
- FIG. 16 is a block diagram illustrating one example of a hardware configuration.
- a direction of an arrow in the drawing illustrates one example, and does not limit a direction of a signal between blocks.
- the anomaly detecting device 100 illustrated in FIG. 1 includes a series-feature extracting unit 101 , a series-probability-distribution calculating unit 102 , a reference-probability-distribution storage unit 103 , a state-feature calculating unit 104 , and an anomaly detecting unit 105 .
- the series-feature extracting unit 101 acquires series data (a signal in FIG. 1 ) as an input, and outputs a feature amount extracted from the series data. More specifically, the series-feature extracting unit 101 extracts a predetermined feature amount from input series data, and then outputs the feature amount.
- a feature amount extracted by the series-feature extracting unit 101 may be, for example, a predetermined feature amount of a signal at a time point of each time frame defined by a predetermined time unit.
- a series feature amount a feature amount extracted from series data is referred to as a series feature amount.
- the series-probability-distribution calculating unit 102 acquires a series feature amount as an input, and calculates and outputs a series probability distribution being a probability distribution which the series feature amount follows.
- a series probability distribution needs only to be something representing as to what kind of series feature amount and with what kind of probability the series data output.
- a series probability distribution is related to under what state of a generation mechanism the series data serving as a basis of the series feature amount are generated.
- the reference-probability-distribution storage unit 103 stores a reference probability distribution being a probability distribution serving as a reference for a series probability distribution.
- a series probability distribution is related to a state set as a reference by a user, in a state of a generation mechanism of input series data.
- the state-feature calculating unit 104 acquires, as inputs, a series probability distribution calculated by the series-probability-distribution calculating unit 102 , and a reference probability distribution stored in the reference-probability-distribution storage unit 103 , and outputs a state feature amount. More specifically, the state-feature calculating unit 104 calculates a state feature amount representing a fluctuation condition of a series probability distribution viewed from an input reference probability distribution, and then outputs the state feature amount. In the present example embodiment, the state-feature calculating unit 104 calculates a plurality of state feature amounts.
- the state-feature calculating unit 104 may calculate, for example, a state feature amount for each signal included in series data, as a second feature amount of a signal for which a series feature amount is calculated. Moreover, for example, the state-feature calculating unit 104 may output a calculated state feature amount, in relation to a time index of a signal included in series data.
- the anomaly detecting unit 105 acquires, as inputs, a plurality of state feature amounts output from the state-feature calculating unit 104 , and outputs presence or absence of an anomaly of series data. More specifically, the anomaly detecting unit 105 senses presence or absence of an anomaly in a state of a generation mechanism of input series data, based on a plurality of input state feature amounts, and then outputs presence or absence of an anomaly.
- the anomaly detecting unit 105 may designate, as second series data, data in which a state feature amount, calculated from series data, for respective time frames defined by a predetermined time unit are arranged in a time-series form, statistically process the second series data, and then sense presence or absence of an anomaly.
- the anomaly detecting unit 105 may calculate a probability distribution of a state feature amount, as a model of a state feature amount in series data, for example, based on two or more state feature amounts, and sense presence or absence of an anomaly by using the calculated probability distribution of the state feature amount.
- FIG. 2 is a flowchart illustrating one example of an operation of the anomaly detecting device 100 according to the present example embodiment.
- step S 101 series data are input to the anomaly detecting device 100 (step S 101 ).
- step S 102 the series-feature extracting unit 101 calculates a series feature amount from the input series data (step S 102 ).
- the series-probability-distribution calculating unit 102 calculates a series probability distribution, based on the calculated series feature amount (step S 103 ).
- the state-feature calculating unit 104 calculates a state feature amount, based on the calculated series probability distribution, and a reference probability distribution stored in the reference probability distribution storage unit 103 (step S 104 ).
- the anomaly detecting unit 105 detects an anomaly of the series data, based on the two or more state feature amounts calculated from the series data (step S 105 ).
- an anomaly is detected by using a plurality of state feature amounts representing fluctuation conditions of states of a generation mechanism of input series data with respect to a reference state, and therefore, it is possible to statistically treat the fluctuation conditions of the generation mechanism which changes from moment to moment.
- an anomaly is detected by using two or more state feature amounts, on a presumption that a state feature amount changes from moment to moment.
- FIG. 3 is a configuration diagram illustrating an example of the anomaly detecting device 200 according to the present example embodiment.
- the anomaly detecting device 200 illustrated in FIG. 3 includes a series-data analyzing unit 210 and an anomaly detecting unit 205 .
- the series-data analyzing unit 210 is a processing unit which acquires series data (a signal in FIG. 3 ) as an input, and outputs a state feature amount, and includes a series-feature extracting unit 201 , a probability-distribution calculating unit 202 , a reference-probability-distribution storage unit 203 , and a state-feature calculating unit 204 .
- the series-feature extracting unit 201 the probability-distribution calculating unit 202 , the reference-probability-distribution storage unit 203 , and the state-feature calculating unit 204 relate to the series-feature extracting unit 101 , the series-probability-distribution calculating unit 102 , the reference-probability-distribution storage unit 103 , and the state-feature calculating unit 104 according to the first example embodiment.
- the anomaly detecting device 200 may be implemented with these processing units as one combined unit (the series-data analyzing unit 210 in the present example embodiment), or may be individually implemented with the processing units as in the first example embodiment.
- the series-feature extracting unit 201 extracts a predetermined feature amount (series feature amount) from input series data, and then outputs the feature amount.
- the probability-distribution calculating unit 202 acquires the series feature amount as an input, and calculates and outputs a probability distribution (series probability distribution) which the input series feature amount follows.
- the reference-probability-distribution storage unit 203 stores a reference probability distribution.
- the state-feature calculating unit 204 acquires, as inputs, the series probability distribution and the reference probability distribution, and calculates and outputs a state feature amount, based on the input series probability distribution and the reference probability distribution.
- the anomaly detecting unit 205 relates to the anomaly detecting unit 105 according to the first example embodiment.
- the anomaly detecting unit 205 acquires, as an input, the state feature amount output from the series-data analyzing unit 210 , and detects an anomaly.
- x(t) is, for example, a digital signal series acquired by analog to digital conversion (AD conversion) of an analog signal recorded with a sensor such as a microphone.
- the present example embodiment assumes the following case.
- a microphone is placed in an environment where an anomaly needs to be detected (hereinafter, referred to as a target environment). Then, an acoustic signal recorded with the microphone is sequentially input to the anomaly detecting device 200 . Then, an anomalous change is detected in states of a target environment which changes from moment to moment.
- activity of a person existing in a target environment, operation of an apparatus driven in a target environment, a state of a peripheral environment of a target environment, or the like corresponds to a state of a generation mechanism of series data.
- the present example embodiment is intended to detect an anomalous change in status of a target environment which changes from moment to moment (more specifically, a state of a generation mechanism of series data).
- the series-data analyzing unit 210 acquires series data x(t) as an input, and outputs a state feature amount d(i).
- a state feature amount d(i) d(i)
- operations of the series-feature extracting unit 201 , the probability-distribution calculating unit 202 , the reference-probability-distribution storage unit 203 , and the state-feature calculating unit 204 constituting the series-data analyzing unit 210 are described.
- the series-feature-extracting unit 201 acquires series data x(t) as an input, and extracts and outputs a predetermined series feature amount y(i).
- i represents a time frame index.
- y(i) is a vector which stores K-dimensional feature amount at a time frame i.
- a time frame is a unit of time width for extracting the series feature amount y(i) from the series data x(t).
- a user may select an expression form of a feature amount of a signal designated as a series feature amount, depending on a kind of signal.
- a feature amount of an acoustic signal a publicly known mel-frequency cepstrum coefficients (MFCC) feature amount or the like is widely used in general.
- MFCC mel-frequency cepstrum coefficients
- approximately 20 is used as a dimensional number K of a feature amount.
- a series feature amount is not limited to the MFCC feature amount, and may be any feature amount expressing a frequency and/or power of sound.
- the probability-distribution calculating unit 202 calculates and outputs a series probability distribution p i (y) being a probability distribution which the input series feature amount y(i) follows.
- the series probability distribution p i (y) represents what and how much sound is included in a target environment, at a time point of the time frame i.
- a Gaussian mixture distribution, a hidden Markov model, or the like is used as an expression form of the series probability distribution p i (y).
- ⁇ r,i , ⁇ r,i ) represents a K-dimensional Gaussian distribution characterized by a K-dimensional mean vector ⁇ r,i and a covariance matrix ⁇ r,i of K ⁇ K.
- R represents a total number of Gaussian distributions
- r represents an index of each Gaussian distribution
- ⁇ r,i represents weight of an r-th Gaussian distribution.
- the hidden Markov model when used, it is only necessary to designate, as a latent state, a state of a mechanism for generating series data, designate, as observation data, a series feature amount being a feature amount of series data generated therefrom, and then calculate, from the series data, a probability that the series data are observed, and a transition probability of the state of the mechanism.
- a reference probability distribution p s (y) is stored in the reference-probability-distribution storage unit 203 .
- a probability distribution in an expression form similar to the series probability distribution p i (y) is used for the reference probability distribution p s (y).
- the reference probability distribution p s (y) is represented as in [Equation 2] below.
- the state-feature calculating unit 204 acquires the series probability distribution p i (y) and the reference probability distribution p s (y) as inputs, and extracts the state feature amount d(i) representing a fluctuation condition of the series probability distribution p i (y) viewed from the reference probability distribution p s (y).
- the state-feature calculating unit 204 uses, as the state feature amount d(i), a distance, between input probability distributions, calculated by a predetermined method.
- the state-feature calculating unit 204 may use, for example, Kullback-Leibler divergence (KL divergence) between p s (y) and p i (y) or the like, as the state feature amount d(i).
- KL divergence Kullback-Leibler divergence
- the state-feature calculating unit 204 uses the following distance.
- the distance is a vector in which R numbers of KL divergences of respective r-th Gaussian distributions are arranged, a norm of the vector, an R-dimensional vector in which R numbers of square distances of mean vectors of respective r-th Gaussian distributions are arranged, a norm of the R-dimensional vector, or the like.
- the state feature amount d(i) becomes a vector value represented by [Equation 3] below.
- [Equation 3] d ( i ) [( ⁇ 1,i ⁇ 1,s ) 2 , . . . ,( ⁇ r,i ⁇ r,s ) 2 , . . . ,( ⁇ R,i ⁇ R,s ) 2 ] (3)
- the state feature amount d(i) becomes a scalar value represented by [Equation 4] below.
- Equation 4] d ( i ) ( ⁇ 1,i ⁇ 1,s ) 2 + . . . +( ⁇ r,i ⁇ r,s ) 2 + . . . +( ⁇ R,i ⁇ R,s ) 2 (4)
- the state feature amount d(i) becomes a feature amount representing a direction of a change from the reference probability distribution p s (y) to the series probability distribution p i (y). Furthermore, in the case of a scalar value, the state feature amount d(i) becomes a feature amount representing magnitude of a change from p s (y) to p i (y).
- the state feature amount d(i) is described as a scalar value.
- the anomaly detecting device 200 may alter the anomaly detecting unit 205 at a subsequent stage into a format related to a vector value such as to change to an anomaly detecting method in which a vector value is acquired as an input.
- the reference-probability-distribution storage unit 203 may hold, as the reference probability distribution p s (y), for example, a probability distribution previously calculated by using, as series data for calculating a reference probability distribution, series data when a generation mechanism of series data is in a predetermined state.
- the anomaly detecting device 200 may include, at a stage prior to the reference-probability-distribution storage unit 203 , a reference-probability-distribution generation unit that calculates a reference probability distribution from series data for calculating a reference probability distribution and then stores the reference probability distribution in the reference-probability-distribution storage unit 203 .
- the reference-probability-distribution storage unit 203 may hold, as series data for calculating a reference probability distribution, for example, a probability distribution calculated by using an acoustic signal recorded in a silent late-night situation.
- the state feature amount d(i) becomes a feature amount representing a fluctuation condition of how a state of a target environment in a time frame i changes as compared with a state of a silent target environment.
- a probability distribution calculated by using all acoustic signals recorded for one day, or a probability distribution calculated by using an acoustic signal in a particular time interval of interest may be used as a reference probability distribution.
- the reference-probability-distribution storage unit 203 may use a series probability distribution p i-1 (y) as a reference probability distribution.
- FIG. 4 is a block diagram illustrating an example of the above-described reference-probability-distribution generation unit.
- series data for calculating a reference probability distribution (a signal for calculating a reference probability distribution in FIG. 4 ) are input to a series-feature extracting unit 221 .
- the series-feature extracting unit 221 extracts and outputs a series feature amount from input series data for calculating a reference probability distribution.
- a reference-probability-distribution calculating unit 222 acquires the calculated series feature amount as an input, calculates a probability distribution thereof, and stores the probability distribution in the reference-probability-distribution storage unit 203 .
- operations of the series-feature extracting unit 221 and the reference-probability-distribution calculating unit 222 may be similar to those of the series-feature extracting unit 201 and the probability-distribution calculating unit 202 .
- prepared data, or past data (particularly, series data which are not determined to be anomalous) acquired during an operation of the anomaly detecting device 200 may be used for series data for calculating a reference probability distribution. In the latter case, the reference-probability-distribution generation unit may successively calculate a reference probability distribution.
- the operations of the series-feature extracting unit 221 and the reference-probability-distribution calculating unit 222 in the reference-probability-distribution generation unit may be performed by the series-feature extracting unit 201 and the probability-distribution calculating unit 202 of the series-data analyzing unit 210 .
- the anomaly detecting unit 205 acquires the state feature amount d(i) as an input, and senses an anomalous state of a generation mechanism of series data x(t).
- the anomaly detecting unit 205 may designate, as second series data, for example, data in which state feature amounts d(i) are arranged in a time-series form, statistically process the second series data, and then detect an anomaly (a statistical outlier or a change point in a state of a generation mechanism).
- the anomaly detecting unit 205 can use a method described in above-described PTL 1 as statistical processing.
- the anomaly detecting unit 205 sequentially inputs the state feature amount d(i) for each time frame as series data, and models the probability generated by such series data (a series including prior state feature amount), by representing a probability. Then, the anomaly detecting unit 205 may detect a statistical outlier or a change point in a state of a generation mechanism, based on an outlier score calculated based on a modeled probability distribution and input series data (a latest state feature amount d(i)).
- the operation in the present example embodiment is only different in that generation processing for reference probability distribution is separately performed (as preprocessing of anomaly detecting processing, or in parallel with anomaly detecting processing), and is basically similar to that in the first example embodiment.
- the generation processing for reference probability distribution may be performed by a device other than the anomaly detecting device 200 .
- there is a case where operations in the step S 102 to the step S 104 in the first example embodiment illustrated in FIG. 2 are referred to as series data analyzing processing.
- FIG. 5 is a flowchart illustrating an example of a processing flow of reference-probability-distribution generation processing.
- the series-feature extracting unit 221 extracts a series feature amount from the input series data for generating a reference probability distribution (step S 212 ).
- the reference-probability-distribution calculating unit 222 calculates a probability distribution which the calculated series feature amount follows (step S 213 ), and stores the probability distribution in the reference-probability-distribution storage unit 203 as a reference probability distribution (step S 214 ).
- the method described in PTL 1 is a method of sensing a change point or an outlier, based on a series feature amount output by the series-feature extracting unit 201 referred to in the present example embodiment.
- the present example embodiment detects an anomaly by using a state feature amount based on a fluctuation condition of a state in a generation mechanism of input series data with respect to a reference state, and therefore solves such an issue.
- FIG. 6 is a configuration diagram illustrating an example of the anomaly detecting device 300 according to the present example embodiment.
- the anomaly detecting device 300 illustrated in FIG. 6 includes a series-data analyzing unit 301 , a normal-model storage unit 302 , and an anomaly detecting unit 303 .
- the series-data analyzing unit 301 may be similar to the series-data analyzing unit 210 according to the second example embodiment. In other words, the series-data analyzing unit 301 acquires the series data x(t) (a signal in FIG. 6 ) as an input, and calculates and outputs the state feature amount d(i).
- the normal-model storage unit 302 stores a normal model in which a state feature amount in a normal state (normal time) is modeled.
- the normal model may be, for example, a probability distribution of a state feature amount in a normal state at a time point indicated by a model index signifying at least a time within a particular period.
- the normal-model storage unit 302 may store a plurality of normal models related to a plurality of model indexes signifying different times within a particular period.
- the anomaly detecting device 300 may include, at a stage prior to the normal-model storage unit 302 , a normal-model generation unit that calculates a normal model from series data for calculating a normal model and then stores the normal model in the normal-model storage unit 302 .
- FIG. 7 is a block diagram illustrating an example of the normal-model generation unit.
- a normal model calculation method first, series data for calculating a normal model (a signal for calculating a normal model in FIG. 7 ) are input to a series-data analyzing unit 311 .
- the series-data analyzing unit 311 calculates a state feature amount from the input series data for calculating a normal model.
- a normal-model calculating unit 312 acquires the calculated state feature amount as an input, models status of a periodic change of the state feature amount, and stores the model in the normal-model storage unit 302 as a normal model. Note that an operation of the series-data analyzing unit 311 may be similar to that of the series-data analyzing unit 301 .
- prepared data, or past data (particularly, series data which are not determined to be anomalous) acquired during an operation of the anomaly detecting device 300 may be used for series data for calculating a normal model.
- the normal-model generation unit may successively calculate a normal model.
- the operation of the series-data analyzing unit 311 in the normal-model generation unit may be performed by the series-data analyzing unit 301 .
- a probability distribution q m (d(i)) of a state feature amount d(i) of a time frame i related to m is described as an example.
- m is an index regarding a model.
- a normal model generation method and an example of m are described by using, as an example, a case of detecting an anomaly of a facility from an acoustic signal.
- Sound generated in a facility or the like ordinarily changes with a period of one day, based on human activity.
- a microphone is placed at an entrance of a school building for detection of an anomaly in a school facility or the like.
- a quiet time period and a noisy time period alternately repeat with a rapid change in accordance with repetitions of a lecture and a recess. Then, at an entrance of a school building, it gradually becomes silent after a time of leaving school, and night comes. In this way, a change of sound repeats with a 24-hour period. Along with such a change, the state feature amount d(i) also changes with a 24-hour period.
- i is a time frame index, and keeps increasing in value while the device keeps operating with a predetermined time (e.g., a device operation start time) as 0.
- a predetermined time e.g., a device operation start time
- the normal-model generation unit calculates q m (d(i)) by using a plurality of such d(i)s that i becomes the time m.
- q m (d(i)) is based on a premise that a state at the normal time m is observed with variation in accordance with a day (period) under a certain average.
- the normal-model generation unit may use, for example, a Gaussian mixture distribution or a hidden Markov model, as an expression form of the normal model q m (d(i)).
- the normal-model generation unit designates a state of a generation mechanism of series data as a latent state. Then, the normal-model generation unit needs only to designate, as observation data, a state feature amount indicating a fluctuation condition of a series feature amount being a feature amount of series data generated from the generation mechanism with respect to a reference, and then calculate a probability that the state feature amount is observed in a normal state, and a transition probability of a state of a generation mechanism.
- a normal model is generated by using 24 hours as a unit of a period
- a normal model needs only to be generated by using m defined by the activity period.
- m may be defined by day of week and time, and a normal model related to time for each day of week may be generated.
- a user can freely set a period of generating a normal model so that m is defined in accordance to lengths of a lecture and a recess or the like.
- a normal model it is also possible to use a combination of a plurality of normal models, such as a normal model for each day of week, and a normal model for repetitions of a lecture and a recess thereof. In this case, one state feature amount may be used for generation of a plurality of normal models.
- the anomaly detecting unit 303 senses and outputs presence or absence of an anomaly in a state of a generation mechanism of series data input to the anomaly detecting device 300 .
- the anomaly detecting unit 303 may calculate a score representing a probability that a normal model, which is indicated by using m to which i of an input state feature amount d(i) is related, takes the state feature amount d(i), and then sense presence or absence of an anomaly, based on the score.
- a score may be, for example, a probability value acquired by substituting an input state feature amount d(i) for a probability distribution q m (d(i)) stored in the normal-model storage unit 302 as a normal model.
- the anomaly detecting unit 303 may determine that there is an anomaly when a calculated score is less than a previously defined threshold, and may determine that there is no anomaly when a calculated score is equal to or more than the threshold.
- FIG. 8 is a flowchart illustrating one example of an operation of the anomaly detecting device 300 according to the present example embodiment.
- series data x(t) are input to the anomaly detecting device 300 (step S 301 ).
- the series-data analyzing unit 301 performs analyzing processing of series data for the input series data x(t), and outputs an acquired state feature amount d(i) (step S 302 ).
- the anomaly detecting unit 303 detects an anomaly of the series data x(t), based on the state feature amount d(i), and a normal model stored in the normal-model storage unit 302 (step S 303 ).
- the anomaly detecting device 300 may perform normal model generation processing as preprocessing of the above-described anomaly detecting processing, or in parallel with the anomaly detecting processing.
- FIG. 9 is a configuration diagram illustrating an example of the anomaly detecting device 400 according to the present example embodiment.
- the anomaly detecting device 400 illustrated in FIG. 9 includes a series-data analyzing unit 401 , a state-feature-series generation unit 402 , and an anomaly detecting unit 403 .
- the series-data analyzing unit 401 is similar to the series-data analyzing unit 210 according to the second example embodiment. In other words, the series-data analyzing unit 401 acquires the series data x(t) (a signal in FIG. 9 ) as an input, and calculates and outputs the state feature amount d(i).
- the state-feature-series generation unit 402 acquires the state feature amount d(i) as an input, and outputs the state feature amount series d 2 (y).
- the state feature amount series d 2 (j) is a vector having a same dimensional number as d(i) acquired based on conversion (reconstruction) of the state feature amount d(i), or a scalar value.
- j is an index regarding a state feature amount series.
- a generation method for a state feature amount series and an example of j are described by using, as an example, a case of detecting an anomaly of a facility from an acoustic signal.
- sound generated in a facility or the like ordinarily changes with a predetermined period (e.g., 24 hours) in accordance with human activity. This represents that a state feature amount also changes with a predetermined period.
- a case where a period is 24 hours has been described as an example this time.
- j needs only to be defined based on the activity period.
- y may be defined by a day of week and time.
- j is defined in such a way as to be related to lengths of a lecture and a recess, a user may freely set a period of extracting a state feature amount as an element of a state feature amount series.
- j is preferably defined in such a way that a state feature amount of a time frame that can be regarded as a same state in a state of a generation mechanism of repeated series data can be extracted. Note that definition of j is not limited to one definition.
- state feature amount series related to a plurality of periods may be generated such as a state feature amount series for each day of week, and state feature amount series for each lecture and for each recess.
- one state feature amount may be used for generation of a plurality of state feature amount series.
- the anomaly detecting unit 403 acquires the state feature amount series d 2 (j) as an input, and senses an anomalous state of a generation mechanism of series data x(t).
- the anomaly detecting unit 403 may detect presence or absence of an anomaly from the state feature amount series d 2 (j), for example, by using the method described in above-described PTL 1.
- the anomaly detecting unit 403 sequentially inputs the state feature amount series d 2 (j) as series data.
- the anomaly detecting unit 403 models a probability that such series data (e.g., a series of the state feature amount d(i) having the prior time frame i related to the j) are generated, by representing the probability with a probability distribution.
- the anomaly detecting unit 403 may detect a statistical outlier or a change point in a state of a generation mechanism, based on an outlier score calculated based on a modeled probability distribution and input series data (a latest state feature amount d(i) having a time frame i related to the j).
- FIG. 10 is a flowchart illustrating one example of an operation of the anomaly detecting device 400 according to the present example embodiment. Note that operations in a step S 401 to a step S 402 are similar to those in the step S 301 to the step S 302 according to the third example embodiment.
- the state-feature-series generation unit 402 when a state feature amount d(i) is calculated in series data analyzing processing (step S 402 ), the state-feature-series generation unit 402 generates a state feature amount series d 2 (j) from the state feature amount d(i) (step S 403 ).
- the anomaly detecting unit 403 detects an anomaly of series data x(t), based on the state feature amount series d 2 (j) (step S 404 ).
- FIG. 11 is a configuration diagram illustrating an example of the anomaly detecting device 500 according to the present example embodiment.
- the anomaly detecting device 500 illustrated in FIG. 11 includes a distributed-data analyzing unit 510 , a normal-model storage unit 502 , and an anomaly detecting unit 503 .
- the distributed-data analyzing unit 510 is a processing unit which acquires each piece of series data x 1 (t), . . . , and x N (t) (signals 1 to N in FIG. 11 ) generated from N numbers of generation mechanisms as an input, and calculates a state feature amount from each piece of series data.
- the distributed-data analyzing unit 510 includes N numbers of series-data analyzing units 501 (series-data analyzing units 501 - 1 to 501 -N).
- the series-data analyzing units 501 - 1 to 501 -N respectively acquire series data x n (t) related to themselves as an input, and output state feature amounts d(i,n).
- n represents an index of a generation mechanism of series data (hereinafter, referred to as a mechanism index).
- the series-data analyzing unit 501 - 1 acquires series data x 1 (t) as an input, and outputs a state feature amount d(i,1).
- n may be defined as an identifier of a microphone, or may be defined as an index of a space where a microphone is placed (e.g., a three-dimensional coordinate of a place where a microphone is placed).
- n may be defined as an identifier of a place where a microphone is placed. For example, when a microphone is placed in each classroom for anomaly detection in a school facility, n may be defined as an index of a classroom where a microphone is placed.
- FIG. 12 is a block diagram illustrating a configuration example of the series-data analyzing units 501 - n .
- each series-data analyzing unit 501 includes a series-feature extracting unit 511 , a probability-distribution calculating unit 512 , a reference-probability-distribution storage unit 513 , and a state-feature calculating unit 514 .
- operations of the series-feature extracting unit 511 and the probability-distribution calculating unit 512 are basically similar to those of the series-feature extracting unit 201 and the probability-distribution calculating unit 202 according to the second example embodiment.
- references-probability-distribution storage unit 513 and the state-feature calculating unit 514 are basically similar to those of the reference-probability-distribution storage unit 203 and the state-feature calculating unit 204 according to the second example embodiment.
- the reference-probability-distribution storage unit 513 can also store a reference probability distribution in a predetermined generation mechanism as a reference probability distribution. This is because an input of the anomaly detecting device 500 is each piece of series data generated from N numbers of generation mechanisms. In other words, in the anomaly detecting device 200 in which one piece of series data is input, a reference probability distribution represents a state of a target environment at a predetermined time. In contrast, in the present example embodiment, a normal state in a generation mechanism indicated by a mechanism index n can be defined as a reference.
- the state feature amount d(i,n) represent a feature of the peripheral state of the place indicated by the n when a peripheral state of the first place (n1) is regarded as a reference.
- it is possible to sense an anomalous state by using not only a relationship in a time series but also a relationship (a spatial relationship when an acoustic signal is referred to) among a plurality of generation mechanisms.
- a generation mechanism to be a reference may differ according to n.
- the normal-model storage unit 502 stores a normal model in which a state feature amount d(i,n) in a normal state is modeled. Note that, although illustration is omitted, the anomaly detecting device 500 may include, at a stage prior to the normal-model storage unit 502 , the normal-model generation unit that generates a normal model from the state feature amount d(i,n) and stores the normal model in the normal-model storage unit 502 .
- m is an index regarding a model.
- m in the third example embodiment is an index relating to time
- m in the present example embodiment is related to a mechanism index n in addition to time.
- the normal-model generation unit may define m as “n related to n′( ⁇ n) in which the first place (n1) is regarded as a reference”, and then generate a normal model by using a feature amount of n in which the first place (n1) is regarded as a reference.
- the normal-model generation unit may define m by combining a plurality of aspects (a day of week and time, a place and a reference, and the like) regarding a time and a mechanism index.
- the normal-model generation unit may generate a plurality of kinds of normal models by using a plurality of kinds of ms (m1, m2, . . . and the like) defined in accordance with the respective aspects.
- a normal model generation method may be similar to that in the third example embodiment.
- a normal model may be, for example, a probability distribution q m (d(i,n)) of a state feature amount d(i,n) of a time frame i and a mechanism index n related to m.
- the anomaly detecting unit 503 senses and outputs presence or absence of an anomaly in a state of a generation mechanism of series data input to the anomaly detecting device 500 , based on a state feature amount d(i,n) input from the distributed-data analyzing unit 510 .
- the anomaly detecting unit 503 may calculate a score representing a probability that a normal model, which is indicated in accordance with m to which i and n of each input state feature amount d(i,n) are related, takes the state feature amount d(i,n), and then sense presence or absence of an anomaly, based on the score.
- a method of calculating a score and a method of determining presence or absence of an anomaly, based on a score may be similar to those in the third example embodiment.
- FIG. 13 is a flowchart illustrating one example of an operation of the anomaly detecting device 500 according to the present example embodiment.
- N numbers of series data x 1 (t), . . . , and x N (t) are input to the anomaly detecting device 500 .
- Each piece of series data x n (t) is input to the distributed-data analyzing unit 510 - n related.
- Each of the distributed-data analyzing units 510 - n performs series data analyzing processing for input series data x n (t) (step S 501 - 1 to step S 501 -N).
- the series data analyzing processing is similar to that in the second example embodiment.
- the anomaly detecting unit 503 detects anomalies of the N numbers of series data x 1 (t), . . . , and x N (t), based on the state feature amounts d(i,n) acquired from the N numbers of the distributed-data analyzing units 510 - n , and a normal model (step S 502 ).
- the present example embodiment it is possible to sense an anomaly, based on the state feature amounts based on a relationship among a plurality of generation mechanisms, in addition to a relationship of time such as a period of change in a state of one generation mechanism. Therefore, in addition to an advantageous effect in the third example embodiment, it is possible to sense an anomaly based on a relationship among generation mechanisms of input series data. In other words, based on the present example embodiment, it is possible to detect an anomalous outlier or change viewed from a relationship among a plurality of generation mechanisms.
- FIG. 14 is a configuration diagram illustrating an example of the anomaly detecting device 600 according to the present example embodiment.
- the anomaly detecting device 600 illustrated in FIG. 14 includes a distributed-data analyzing unit 610 , a state-feature-series generation unit 602 , and an anomaly detecting unit 603 .
- the distributed-data analyzing unit 610 performs an operation similar to that of the distributed-data analyzing unit 510 according to the fifth example embodiment, acquires, as inputs, the series data x 1 (t), x 2 (t), . . . , and x N (t) (signals 1 to N in FIG. 14 ) generated from N numbers of generation mechanisms, and outputs the state feature amount d(i,n).
- the distributed-data analyzing unit 610 includes N numbers of series-data analyzing units 601 (series-data analyzing units 601 - 1 to 601 -N).
- the state-feature-series generation unit 602 acquires the state feature amount d(i,n) as an input, and outputs a state feature amount series d 2 (j,n).
- the state feature amount series d 2 (j,n) is a vector having a same dimensional number as d(i,n) acquired based on conversion of the state feature amount d(i,n) or a scalar value.
- j is an index regarding a state feature amount series. Note that definition of j may be similar to that in the state-feature-series generation unit 402 according to the fourth example embodiment.
- the state feature amount series d 2 (j,n) can be said to be the state feature amount series d 2 (j) generated for each mechanism index n in the state-feature-series generation unit 402 .
- the state-feature-series generation unit 602 is obtained by changing a form related to n in such a way that the operation of the state feature series generation unit 402 is performed N times.
- the anomaly detecting unit 603 acquires the state feature amount series d 2 (j,n) as an input, and senses an anomalous state of a generation mechanism of series data x n (t).
- d 2 (j,n) includes an index j related to time and a mechanism index n
- the anomaly detecting unit 603 can detect an anomaly viewed from not only a time relationship but also a relationship of a generation mechanism.
- an anomaly detecting method in the anomaly detecting unit 603 may be similar to that in the anomaly detecting unit 403 according to the fourth example embodiment.
- the anomaly detecting unit 603 may define j in such a way that j is related to not only i but also n, similarly to m.
- a format of a state feature amount series output by the state-feature-series generation unit 602 is d 2 (j), but a value that j can take only changes, and there is no change in that the state feature amount series can represent both a time relationship and a relationship among generation mechanisms.
- FIG. 15 is a flowchart illustrating one example of an operation of the anomaly detecting device 600 according to the present example embodiment. Note that operations in a step S 601 - 1 to a step S 601 -N are similar to those in the step S 501 - 1 to the step S 501 -N according to the fifth example embodiment.
- the state-feature-series generation unit 602 when a state feature amount d(i,n) is calculated in analyzing processing of each piece of series data, the state-feature-series generation unit 602 generates the state feature amount series d 2 (j,n) from the state feature amount d(i,n) (step S 602 ).
- the anomaly detecting unit 603 detects anomalies of the N numbers of series data x 1 (t), . . . , and x N (t), based on the state feature amount series d 2 (j,n) (step S 603 ).
- the present example embodiment designates, as new series data (state feature amount series), a collection of state feature amounts based on a relationship among a plurality of generation mechanisms, in addition to a relationship of time such as a period of a change in a state of one generation mechanism, and detects an anomaly, based on the series data. Therefore, in addition to an advantageous effect in the fourth example embodiment, it is possible to detect an anomaly based on a relationship among generation mechanisms of input series data. In other words, based on the present example embodiment, it is possible to detect an anomaly viewed from a relationship among a plurality of generation mechanisms.
- series data are not limited to a time-series acoustic signal.
- series data may be any series data such as a time-series temperature signal acquired from a temperature sensor, a time-series vibration signal acquired from a vibration sensor, or a video signal acquired from a camera.
- series data may be time-series data of electric power usage amount, series data of electric power usage amount for each consumer, time-series data of traffic intensity in a network, time-series data of an air quantity, or spatial series data of precipitation amount in a certain range.
- series data may otherwise be angle series data, or discrete series data of text or the like.
- series data include not only equally interval series data but also unequally interval series data.
- the present invention may be applied to a system composed of a plurality of apparatuses, or may be applied to a single device. Moreover, the present invention is also applicable to a case where an information processing program which achieves a function according to an example embodiment is directly or remotely supplied to a system or a device. Therefore, in order to achieve a function according to the present invention in a computer, a program installed in a computer, or a medium storing the program, and a world wide web (WWW) server into which the program is downloaded also fall within the scope of the present invention. Particularly, at least a non-transitory computer readable medium storing a program for a computer to execute a processing step included in the example embodiments described above falls within the scope of the present invention.
- WWW world wide web
- the anomaly detecting device 100 is configured as follows.
- each component of the anomaly detecting device 100 may be configured by a hardware circuit.
- each component may be configured by using a plurality of devices connected via a network.
- a plurality of components may be configured by one piece of hardware.
- the anomaly detecting device 100 may be achieved as a computer device including a central processing unit (CPU), a read only memory (ROM), and a random access memory (RAM).
- the anomaly detecting device 100 may be achieved as a computer device further including, in addition to the above-described configuration, an input and/or output circuit (IOC) and a network interface circuit (NIC).
- IOC input and/or output circuit
- NIC network interface circuit
- FIG. 16 is a block diagram illustrating one example of a configuration of an information processing device 700 being one example of hardware of the anomaly detecting device 100 .
- the information processing device 700 includes a CPU 710 , a ROM 720 , a RAM 730 , an internal storage device 740 , an IOC 750 , and a NIC 780 , and configures a computer device.
- the CPU 710 reads a program from the ROM 720 . Then, based on the read program, the CPU 710 controls the RAM 730 , the internal storage device 740 , the IOC 750 , and the NIC 780 . Then, a computer including the CPU 710 controls these components, and achieves functions as the series-feature extracting unit 101 , the series-probability-distribution calculating unit 102 , the state-feature calculating unit 104 , and the anomaly detecting unit 105 .
- the CPU 710 may use the RAM 730 or the internal storage device 740 as a temporary storage medium of a program.
- the CPU 710 may read a program included in a recording medium 790 which computer-readably stores the program, by using a non-illustrated storage medium reading device.
- the CPU 710 may receive a program from a non-illustrated external device via the NIC 780 , saves the program in the RAM 730 , and then operate, based on the saved program.
- the ROM 720 stores a program executed by the CPU 710 , and fixed data.
- the ROM 720 is, for example, a programmable-ROM (P-ROM) or a flash ROM.
- the RAM 730 temporary stores a program executed by the CPU 710 , and data.
- the RAM 730 is, for example, a dynamic-RAM (D-RAM).
- the internal storage device 740 stores data and a program saved by the information processing device 700 for a long period.
- the internal storage device 740 operates as the reference-probability-distribution storage unit 103 .
- the internal storage device 740 may operate as a temporary storage device of the CPU 710 .
- the internal storage device 740 is, for example, a hard disk device, a magneto-optical disk, a solid state drive (SSD), or a disk array device.
- the ROM 720 and the internal storage device 740 are non-transitory storage media.
- the RAM 730 is a transitory storage medium.
- the CPU 710 is operable, based on a program stored in the ROM 720 , the internal storage device 740 , or the RAM 730 . In other words, the CPU 710 is operable by using a non-transitory storage medium or a transitory storage medium.
- the IOC 750 mediates data between the CPU 710 and an input apparatus 760 as well as a display apparatus 770 .
- the IOC 750 is, for example, an IO interface card or a universal serial bus (USB) card.
- the IOC 750 is not limited to a wire such as a USB, and may use wireless.
- the input apparatus 760 is an apparatus which receives an input instruction from an operator of the information processing device 700 .
- the input apparatus 760 is, for example, a keyboard, a mouse, or a touch panel.
- the display apparatus 770 is an apparatus which displays information to an operator of the information processing device 700 .
- the display apparatus 770 is, for example, a liquid crystal display.
- the NIC 780 relays exchange of data with a non-illustrated external device via a network.
- the NIC 780 is, for example, a local area network (LAN) card.
- LAN local area network
- the NIC 780 is not limited to a wire, and may use wireless.
- the information processing device 700 configured in this way can acquire an advantageous effect similar to that of the anomaly detecting device 100 .
- a reason for this is that the CPU 710 of the information processing device 700 can achieve a function similar to that of the anomaly detecting device 100 , based on a program.
- An anomaly detecting device includes:
- At least one processor coupled to the memory,
- the processor performing operations, the operations including:
- a reference probability distribution being a probability distribution designated as a reference for the series feature amount in the first series data
- the anomaly detecting device according to supplementary note 1,
- the state feature amount representing, by a predetermined method, a distance between the series probability distribution at a time point of the time frame and the reference probability distribution related to the time point of the time frame
- the anomaly detecting device according to supplementary note 2,
- a normal model being a probability distribution of the state feature amount at a normal time in the first series data, and being a probability distribution of the state feature amount specified based on a model index signifying a time within at least a particular period
- the anomaly detecting device according to supplementary note 4,
- the state feature amount indicated by the normal model related to a time point when the calculated state feature amount is acquired based on a score calculated based on a probability that the state feature amount occurs.
- the anomaly detecting device according to supplementary note 2,
- the anomaly detecting device according to any one of supplementary notes 1 to 6,
- the anomaly detecting device according to supplementary note 7,
- the anomaly detecting device according to supplementary note 1 or 2,
- the anomaly detecting device according to supplementary note 9,
- a normal model being a probability distribution of the state feature amount at a normal time in each piece of the first series data, and being a probability distribution of the state feature amount specified based on a model index signifying a time within at least a particular period
- the anomaly based on the state feature amount calculated from the piece of the first series data, and the normal model related to the piece of the first series data.
- the anomaly detecting device according to supplementary note 9,
- each piece of the first series data designating, as second series data, each of the series of the state feature amounts generated from a plurality of the state feature amounts calculated from the piece of the first series data, statistically processing the second series data, and then detecting the anomaly.
- the anomaly detecting device according to any one of supplementary notes 1, 2, and 9 to 11,
- the anomaly detecting device according to any one of supplementary notes 1, 2, and 9 to 12,
- the anomaly detecting device according to any one of supplementary notes 1, 2, and 9 to 13,
- first series data are time-series acoustic signals.
- the anomaly detecting device according to any one of supplementary notes 1, 2, and 9 to 14,
- the series feature amount is a feature amount expressing a frequency and/or power of sound included in time-series acoustic signals
- the state feature amount is a Kullback-Leibler (KL) divergence, a vector in which a predetermined number of the KL divergences are arranged, a vector in which a predetermined number of square distances of mean vectors of the Gaussian distributions in a predetermined rank are arranged, or a norm of each of the vectors.
- KL Kullback-Leibler
- An anomaly detecting method includes:
- the anomaly detecting method further includes:
- the state feature amount representing, by a predetermined method, a distance between the series probability distribution at a time point of the time frame and the reference probability distribution related to a time point of the time frame;
- the state feature amount representing, by a predetermined method, a distance between the series probability distribution at a time point of the time frame and the reference probability distribution related to the time point;
- the present invention is suitably applicable to not only anomaly detection targeted for such an environment as to change in state even at a normal time, but also anomaly detection for any series data.
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Pure & Applied Mathematics (AREA)
- Computational Mathematics (AREA)
- Mathematical Physics (AREA)
- Mathematical Optimization (AREA)
- Mathematical Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Algebra (AREA)
- Life Sciences & Earth Sciences (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- Probability & Statistics with Applications (AREA)
- Computing Systems (AREA)
- Operations Research (AREA)
- Databases & Information Systems (AREA)
- Automation & Control Theory (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Testing And Monitoring For Control Systems (AREA)
- Complex Calculations (AREA)
Abstract
Description
- [PTL 1] Japanese Unexamined Patent Application Publication No. 2004-054370
- [PTL 2] Japanese Unexamined Patent Application Publication No. 2006-331300
[Equation 3]
d(i)=[(μ1,i−μ1,s)2, . . . ,(μr,i−μr,s)2, . . . ,(μR,i−μR,s)2] (3)
[Equation 4]
d(i)=(μ1,i−μ1,s)2+ . . . +(μr,i−μr,s)2+ . . . +(μR,i−μR,s)2 (4)
[Equation 5]
q m(d(i))=N(d(i)|μm,Σm) (5)
-
- The anomaly detecting device according to any one of
supplementary notes 1 to 3,
- The anomaly detecting device according to any one of
- 100, 200, 300, 400, 500, 600 Anomaly detecting device
- 101, 201, 221, 511 Series-feature extracting unit
- 102 Series-probability-distribution calculating unit
- 202, 512 Probability-distribution calculating unit
- 222 Reference-probability distribution calculating unit
- 103, 203, 513 Reference-probability-distribution storage unit
- 104, 204, 514 State-feature calculating unit
- 105, 205, 303, 403, 503, 603 Anomaly detecting unit
- 210, 301, 311, 401, 501, 601 Series-data analyzing unit
- 302, 502 Normal-model storage unit
- 312 Normal-model calculating unit
- 402, 602 State-feature-series generation unit
- 510, 610 Distributed-data analyzing unit
- 700 Information processing device
- 710 CPU
- 720 ROM
- 730 RAM
- 740 Internal storage device
- 750 IOC
- 760 Input apparatus
- 770 Display apparatus
- 780 NIC
- 790 Recording medium
Claims (16)
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2016-175402 | 2016-09-08 | ||
JPJP2016-175402 | 2016-09-08 | ||
JP2016175402 | 2016-09-08 | ||
PCT/JP2017/031894 WO2018047804A1 (en) | 2016-09-08 | 2017-09-05 | Abnormality detecting device, abnormality detecting method, and recording medium |
Publications (2)
Publication Number | Publication Date |
---|---|
US20190243872A1 US20190243872A1 (en) | 2019-08-08 |
US11397792B2 true US11397792B2 (en) | 2022-07-26 |
Family
ID=61562776
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/329,794 Active 2039-09-03 US11397792B2 (en) | 2016-09-08 | 2017-09-05 | Anomaly detecting device, anomaly detecting method, and recording medium |
Country Status (3)
Country | Link |
---|---|
US (1) | US11397792B2 (en) |
JP (1) | JP7031594B2 (en) |
WO (1) | WO2018047804A1 (en) |
Families Citing this family (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110352349B (en) * | 2017-02-15 | 2023-01-31 | 日本电信电话株式会社 | Abnormal sound detection device, abnormal degree calculation device, abnormal sound generation device, abnormal signal detection method, and recording medium |
CN110110160B (en) | 2017-12-29 | 2020-04-14 | 阿里巴巴集团控股有限公司 | Method and device for determining data exception |
JP7014295B2 (en) * | 2018-05-18 | 2022-02-01 | 日本電気株式会社 | Anomaly detection device, anomaly detection method and program |
JP6967197B2 (en) * | 2018-05-18 | 2021-11-17 | 日本電気株式会社 | Anomaly detection device, anomaly detection method and program |
JP2020035372A (en) * | 2018-08-31 | 2020-03-05 | オムロン株式会社 | Information processing apparatus and information processing method |
JP2020038485A (en) * | 2018-09-04 | 2020-03-12 | 富士通株式会社 | Learning apparatus, determining apparatus, learning method, determining method, learning program and determining program |
US11297096B2 (en) * | 2018-09-27 | 2022-04-05 | Avast Software, S.R.O. | Gaussian autoencoder detection of network flow anomalies |
JP7063229B2 (en) * | 2018-10-24 | 2022-05-09 | オムロン株式会社 | Controllers and control programs |
CN109871870B (en) * | 2019-01-15 | 2021-05-25 | 中国科学院信息工程研究所 | Nearest neighbor-based time sensitivity anomaly detection method in large data flow |
ES2871348T3 (en) * | 2019-01-30 | 2021-10-28 | Buehler Ag | System and procedure to detect and measure anomalies in signaling from components used in industrial processes |
US11277425B2 (en) * | 2019-04-16 | 2022-03-15 | International Business Machines Corporation | Anomaly and mode inference from time series data |
US11271957B2 (en) | 2019-07-30 | 2022-03-08 | International Business Machines Corporation | Contextual anomaly detection across assets |
CN112559292A (en) * | 2020-12-18 | 2021-03-26 | 北京北方华创微电子装备有限公司 | Equipment application monitoring method and semiconductor process equipment |
CN113240211B (en) * | 2021-07-09 | 2021-09-21 | 深圳市格云宏邦环保科技有限公司 | Method and device for predicting wastewater discharge, computer equipment and storage medium |
Citations (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH0894497A (en) | 1994-07-25 | 1996-04-12 | Mitsubishi Electric Corp | Diagnostic system for automobile component |
JPH1026648A (en) | 1996-07-10 | 1998-01-27 | Mitsubishi Electric Corp | Insulation diagnostic device for radiation detector |
JP2004054370A (en) | 2002-07-17 | 2004-02-19 | Nec Corp | Autoregressive model learning device for time series data and device for detecting deviated value and changing point using the same |
US6892163B1 (en) * | 2002-03-08 | 2005-05-10 | Intellectual Assets Llc | Surveillance system and method having an adaptive sequential probability fault detection test |
JP2006331300A (en) | 2005-05-30 | 2006-12-07 | Internatl Business Mach Corp <Ibm> | Abnormality determination apparatus, control method, automobile, and program |
WO2008087968A1 (en) | 2007-01-17 | 2008-07-24 | Nec Corporation | Change-point detecting method and apparatus |
CN102163427A (en) | 2010-12-20 | 2011-08-24 | 北京邮电大学 | Method for detecting audio exceptional event based on environmental model |
JP2013012872A (en) | 2011-06-29 | 2013-01-17 | Mitsubishi Electric Corp | Matrix data preparation device, matrix data preparation method and program |
WO2013105164A1 (en) | 2012-01-13 | 2013-07-18 | 日本電気株式会社 | Abnormal signal determining apparatus, abnormal signal determining method, and abnormal signal determining program |
JP2015064347A (en) | 2013-08-26 | 2015-04-09 | 能美防災株式会社 | Structure deterioration diagnostic system |
-
2017
- 2017-09-05 JP JP2018538414A patent/JP7031594B2/en active Active
- 2017-09-05 US US16/329,794 patent/US11397792B2/en active Active
- 2017-09-05 WO PCT/JP2017/031894 patent/WO2018047804A1/en active Application Filing
Patent Citations (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH0894497A (en) | 1994-07-25 | 1996-04-12 | Mitsubishi Electric Corp | Diagnostic system for automobile component |
JPH1026648A (en) | 1996-07-10 | 1998-01-27 | Mitsubishi Electric Corp | Insulation diagnostic device for radiation detector |
US6892163B1 (en) * | 2002-03-08 | 2005-05-10 | Intellectual Assets Llc | Surveillance system and method having an adaptive sequential probability fault detection test |
JP2004054370A (en) | 2002-07-17 | 2004-02-19 | Nec Corp | Autoregressive model learning device for time series data and device for detecting deviated value and changing point using the same |
JP2006331300A (en) | 2005-05-30 | 2006-12-07 | Internatl Business Mach Corp <Ibm> | Abnormality determination apparatus, control method, automobile, and program |
WO2008087968A1 (en) | 2007-01-17 | 2008-07-24 | Nec Corporation | Change-point detecting method and apparatus |
CN102163427A (en) | 2010-12-20 | 2011-08-24 | 北京邮电大学 | Method for detecting audio exceptional event based on environmental model |
JP2013012872A (en) | 2011-06-29 | 2013-01-17 | Mitsubishi Electric Corp | Matrix data preparation device, matrix data preparation method and program |
WO2013105164A1 (en) | 2012-01-13 | 2013-07-18 | 日本電気株式会社 | Abnormal signal determining apparatus, abnormal signal determining method, and abnormal signal determining program |
JP2015064347A (en) | 2013-08-26 | 2015-04-09 | 能美防災株式会社 | Structure deterioration diagnostic system |
Non-Patent Citations (9)
Title |
---|
Aiba et al., "Decisions of threshold and mixture number for detection of abnormal sounds using multi-stage GMM", Japan Audio Society, document of the Japan Society of Acoustics, vol. 2010, Mar. 10, 2010, pp. 781 to 782. |
Aiba et al., "Segment feature and SVM for detection of abnormal sounds using GMM", Japan Audio Society, Sep. 17, 2009, pp. 621 to 624. |
Harmouche, J. ("Statistical Incipient Fault Detection and Diagnosis with Kullback-Leibler Divergence: From Theory to Applications", 2014, Doctoral dissertation, Supélec) (Year: 2014). * |
International Search Report of PCT/JP2017/031894 dated Nov. 14, 2017 [PCT/ISA/210]. |
Japanese Office Action for JP Application No. 2013-538414 dated Jul. 27, 2021 with English Translation. |
Japanese Office Action for JP Application No. 2018-538414 dated Oct. 19, 2021 with English Translation. |
Tanaka et al., "Abnormal sound detection system using normal sound sequential learning", Japan Audio Society, Mar. 11, 2011, pp. 833 to 834. |
Ueda et al., "Detecting Latent Structural Changed via Latent Dirichlet Allocation", The Institute of Electronics, Information and Communication Engineers, IEICE Technical Report, Mar. 5, 2012, pp. 15-20 (total 6 pages). |
Written Opinion of PCT/JP2017/031894 dated Nov. 14, 2017 [PCT/ISA/237]. |
Also Published As
Publication number | Publication date |
---|---|
JPWO2018047804A1 (en) | 2019-06-24 |
JP7031594B2 (en) | 2022-03-08 |
US20190243872A1 (en) | 2019-08-08 |
WO2018047804A1 (en) | 2018-03-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11397792B2 (en) | Anomaly detecting device, anomaly detecting method, and recording medium | |
CN106471527B (en) | Study is localized from world model | |
US11437028B2 (en) | Method and apparatus for sound analysis | |
US10228994B2 (en) | Information processing system, information processing method, and program | |
US10431116B2 (en) | Orator effectiveness through real-time feedback system with automatic detection of human behavioral and emotional states of orator and audience | |
CN102955900B (en) | Information processor, information processing method | |
JP2020008997A5 (en) | ||
US11470419B2 (en) | Auralization for multi-microphone devices | |
EP3759789B1 (en) | System and method for audio and vibration based power distribution equipment condition monitoring | |
CN109239807A (en) | Rainfall appraisal procedure and system and terminal | |
JP2019169011A (en) | Symptom detection system and program | |
JP2017156978A (en) | Work operation recognition system | |
WO2019220609A1 (en) | Abnormality detection device, abnormality detection method, and program | |
Suwannaphong et al. | Radio signal strength indication augmentation for one-shot learning in indoor localisation | |
JP5846165B2 (en) | Feature amount extraction apparatus, method, and program | |
JP7397801B2 (en) | Apparatus for detecting a subject with breathing disorder and method of operating the apparatus for detecting a subject with breathing disorder | |
JP6545950B2 (en) | Estimation apparatus, estimation method, and program | |
GB2553351A (en) | Salient object detection | |
JP2022015191A (en) | Estimation program, estimation device, estimation method, generation program, generation device, and generation method | |
US20240081707A1 (en) | Stress level estimation method, training data generation method, and storage medium | |
Karasoulas et al. | Hidden Markov models for presence detection based on CO2 fluctuations | |
JP2018017709A (en) | Comfort evaluation system | |
JP6630707B2 (en) | Writing motion measuring system, writing motion measuring method, writing motion measuring program, and writing device | |
KR101972879B1 (en) | Method and apparatus to minimize memory usage at embedded environments | |
Tucker et al. | Updating stochastic networks to integrate cross-sectional and longitudinal studies |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: NEC CORPORATION, JAPAN Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KOMATSU, TATSUYA;KONDO, REISHI;REEL/FRAME:048475/0374 Effective date: 20190214 |
|
FEPP | Fee payment procedure |
Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: APPLICATION DISPATCHED FROM PREEXAM, NOT YET DOCKETED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT RECEIVED |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |